Terrorism: Gambling on the Life of a Business

Sarrah Murray
FT.com/Financial Times
June 1, 2004

While awareness of a rising threat of terrorism has put risk and
security firmly on the board agenda, spending on security
remains low. A report last year from the Conference Board, the
international not-for-profit applied research organisation, found
an average increase in security spending of just 4 per cent
since September 2001. However, insurers and security
consultants point out that blanket spending is not necessarily
the only way for companies to address the risk.

If you are a biscuit manufacturer in the English rural county of
Dorset, for example, heavy expenditure on counter-terrorism and security measures
makes little sense. But a large US business headquartered on New York's Avenue of the
Americas should view the risk differently and act accordingly.

Yossi Sheffi, professor and head of MIT's Centre for Transportation Studies, says risk
assessment can be viewed on a two-by-two matrix, with the probability of an attack on
the vertical axis and the company's resilience and how quickly it can recover on the
horizontal.

US airlines would be on the high end of both axes of the chart. "They are at a high
probability of being attacked and if the airplane goes down due to, say, a missile, my
guess is that the company goes out of business," says Prof Sheffi, who is part of MIT's
Supply Chain Response to Terrorism team, which studies the impact of terrorism on
global supply chains.

McDonald's has a high probability of attack, he says, because of the visibility of its
brand. But because it has thousands of outlets worldwide, attacks on individual
restaurants would not put the company out of business. An unbranded manufacturer of
fashion goods, on the other hand, might have a low probability of attack but if it has a
single distribution centre, an attack on that facility might disrupt business for a
considerable period of time.

At the low end of both axes, explains Prof Sheffi, would be a company such as Ace, the
US hardware supplier. "No one would want to attack them, they have tens of thousands
of outlets and they are all locally operated," he says. "So it's the probability of something
happening to you, set against your resilience and the ability to recover."

A company can use the same framework to identify and prioritise a range of threats. It
might, for instance, assess the chance of a port closing because of a terrorist incident as
high but if it can re-route its shipments the consequences will not be severe. On the
other hand, the closure of an entire set of ports is less likely but - as demonstrated by
the 2002 US West Coast strike - its consequences are far more serious.

When it comes to assessing impact loss of assets is not the only consideration. Paul
Bassett, executive director in Aon's counter-terrorism political risk division, sees an
important part of risk assessment as the ability to recover - and to be seen to as a
"recoverer", rather than a "non-recoverer".

"A company with a robust balance sheet might survive a $100m loss," he says. "But if
you talk in terms of losing 25 per cent of share value because they didn't, and weren't
perceived to, act well post-crisis, that would be of far more concern than the £100m
loss."

When it comes to mitigating such threats, insurance is clearly part of the equation. And
the difficulties of accessing and affording terrorism insurance have eased considerably
since 2001. "Immediately after 9/11, there was limited capacity and only Lloyds could
give one client $50m of cover," says Stephen Ashwell, terrorism underwriter for Hiscox,
the London-based specialist insurer.

Since then capacity has grown significantly and cover is more affordable. "The market
has responded reasonably well - there are a few more entrants coming into the market,
capacity will grow and clients will get the benefits of that," Mr Ashwell says. "You can
now probably buy $1bn of cover for any one client."

However, he points out that companies should be addressing a range of issues as well
as buying insurance. "Insurance is really the last bit of the food chain," he says.
Measures include simple precautions such as installing closed-circuit television cameras
and anti-vehicle protection devices. Large bollards outside a building, for example, can
stop a vehicle being driven into it. Another sensible idea is to move the postroom - which
may be located in a company's main building, making it highly vulnerable to parcel
bombs or packages of anthrax - to an off-site location.

Mr Basset talks of the "!displacement effect". Terrorist groups, he points out, look at the
potential success of any attack. "If there are two similar buildings, they'll go for the target
that affords the greatest chance of success - so if you start as a harder target you're less
likely to suffer an attack."

But he believes that such risk mitigation procedures are part of an overall strategy that
balances risk management with insurance. By understanding their risk companies can
save considerable sums of money by retaining some of the risk and insuring the rest.

"We look at how best to transfer risk to the insurance market and manage the risk," he
says. "There has to be a combination of the two because no insurance policy is going to
save an employee's life - only risk management techniques would do that - and some of
these risks aren't insurable. So only risk management can reduce them."